Sub-processors · published 2026-09-05

Every third party that processes your data.

Listed by tier. Updated within 30 days of any change. Email security@ironbarkaml.com.au to subscribe to changes.

Amazon Web Services (AWS), planned

Standard

Service: Migration target only (ADR-005): compute, S3 Object Lock audit log, KMS. Not yet in use
Country: AU (ap-southeast-2 Sydney, ap-southeast-4 Melbourne DR), planned
Data received: None today. Customer data and the 7-year audit log once the migration completes
Certifications: SOC 2 Type II, ISO 27001, ISO 27017, ISO 27018, IRAP PROTECTED, PCI DSS, FedRAMP, FIPS 140-3 Level 3 KMS
Swap path: GCP ap-southeast-1 or Azure Australia East (6-month migration)

Critical

Critical

Critical

Service: Card payments, subscription billing, Stripe Bridge USDC settlement
Country: US (control plane); processing per acquirer region
Data received: Payment-method tokens (PAN never lands in Ironbark, SAQ-A scope)
Certifications: PCI DSS Level 1, SOC 1 Type II, SOC 2 Type II, ISO 27001
Swap path: PayTo direct (Zepto / Monoova) for AU bank-to-bank rails

Standard

Service: Claude LLM API (Phase 3+ AI agents)
Country: US (control plane; processing US/EU)
Data received: Prompts (PII-excluded by default; opt-in only); no training data use
Certifications: SOC 2 Type II, ISO 27001 (in scope), HIPAA-aligned via Trust Tier
Swap path: AWS Bedrock (Claude in AU region) or OpenAI (re-tuning required)

Standard

Standard

Service: Web scraping (research provider, internal lead-enrichment surface only)
Country: US (control plane)
Data received: Target URLs and page content (no customer PII)
Certifications: SOC 2 in progress
Swap path: Apify or in-house BeautifulSoup + Playwright

Standard

Standard

Service: Neural web search + adverse-media search (internal lead-enrichment surface only)
Country: US (control plane)
Data received: Search queries (no customer PII)
Certifications: SOC 2 in progress
Swap path: Perplexity or Brave Search API

Standard

Service: Sonar API + citation retrieval (internal Q&A oracle)
Country: US (control plane)
Data received: Queries (no customer PII)
Certifications: SOC 2 Type II in scope
Swap path: Anthropic Claude with native web search or Brave + manual citation

Marginal

Service: Marketing site hosting (Next.js)
Country: Global CDN; control plane US
Data received: Page traffic logs (no customer authentication on this surface)
Certifications: SOC 2 Type II, ISO 27001, HIPAA-aligned, GDPR-aligned
Swap path: Cloudflare Pages or AWS Amplify

Critical

Service: All hosting today: API compute, Postgres database, Redis cache, dashboard. Migration to AWS Sydney (ADR-005) not yet started
Country: Singapore (asia-southeast1) for the API; United States (us-west2) for Postgres, Redis and the dashboard
Data received: Customer data (full), at rest and in processing, until the ADR-005 migration completes
Certifications: SOC 2 Type II in progress
Swap path: AWS ECS Fargate ap-southeast-2 (locked migration target)

Tier definitions per Policy 09 (Vendor Risk Management):

Critical: production-path, customer data flows through, replacement requires architecture change
Standard: production-path, customer data flows through, replacement is provider-interface swap
Marginal: operational, no customer data flows, easy replacement

Last reviewed: 2026-09-05.

Next review: 2026-12-05.